Implementation of third-party operational resilience: TheCityUK recommendations

With the implementation of the new operational resilience regulations by the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) in March 2022, firms are now required to identify and remain within their impact tolerances by 31 March 2025.

Ahead of this deadline, UK-based firms also need to ensure the resilience of any third-party services providers on which they depend. This is challenging, especially as global operational resilience regulations evolve. UK regulators should aim for a proportionate, dynamic, and – where possible – interoperable approach to simplify compliance, minimise the risk of regulatory arbitrage, and maintain the global competitiveness of UK firms.

This paper offers recommendations for both firms and regulators to ensure that operational resilience measures not only reduce the impact of disruptions but also encourage innovation and growth. We look forward to continuing the collaboration between industry and regulators to achieve an effective balance. 

Additionally, the PRA and FCA have published joint Consultation Paper (CP) 26/23 'Operational Resilience: Critical Third Parties to the UK Financial Sector'. This is a welcome step and we look forward to engaging with the industry and regulators further on the expectations for critical third parties (CTPs).